Vulnerability · Published Nov 25, 2025 · Assigned by Wordfence
CVE-2025-12040Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in Wishlist for WooCommerce from themehunk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Official description
The Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.3 via several functions in class-th-wishlist-frontend.php due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to modify other user's wishlists
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| themehunk | Wishlist for WooCommerce | 0 – through 1.1.3 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N